Executive brief
A security vulnerability has been identified in GitLab Enterprise Edition that could allow a group administrator to take over the accounts of other members within their group. GitLab is a platform used by organizations to manage their software code and development workflows. If exploited, an attacker with administrative control over a specific group could gain full access to other users' accounts, potentially leading to the theft of sensitive source code or unauthorized changes to software projects.
Technical details
An authorization bypass vulnerability (CWE-639) exists in GitLab EE's Group SAML identity management functionality. The flaw allows an authenticated user with the 'Owner' role for a group to manipulate identity settings to take over the accounts of other members in that group. The vulnerability stems from improper authorization checks when managing SAML identities. This is reachable over the network and requires high privileges (Group Owner). Successful exploitation results in a full account takeover of targeted group members. GitLab has released patches in versions 18.10.8, 18.11.5, and 19.0.2 to address this issue.
Affected products
- GitLab GitLab Enterprise Edition (EE) >=15.5, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
Timeline
- 2026-06-10: patched: GitLab released versions 18.10.8, 18.11.5, and 19.0.2.
- 2026-06-11: disclosed: CVE-2026-6552 published.